copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
1,239 Commits 58 Branches 1 Tag
334a7a44010d3986bb3cdcbd838c1a2117f8d6c2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jeppe B b03500d2d1 Merge pull request #189 from copenhagentruckwash/fix-subuser-token-authorization-vulnerability 
Validate subuser grants before resolving subuser customer context
 2026-06-01 22:21:58 +02:00
Jeppe B ed9ebc2ac8 Validate subuser grants before resolving customer user 2026-06-01 22:21:44 +02:00
Jeppe B e13bbae01f Merge pull request #184 from copenhagentruckwash/fix-edge-broker-default-shared-secret-issue 
Harden edge broker shared secret defaults
 2026-06-01 22:17:57 +02:00
Jeppe B 5ba0f5f9ba Merge pull request #183 from copenhagentruckwash/fix-credential-exposure-in-.env.old 
Remove leaked `.env.old` with credentials and add to `.gitignore`
 2026-06-01 22:17:30 +02:00
Jeppe B bb5f1db1b3 Merge branch 'master' into fix-credential-exposure-in-.env.old 2026-06-01 22:17:21 +02:00
Jeppe B 4183c3928c Merge pull request #187 from copenhagentruckwash/fix-hard-coded-tokens-in-test-file 
Sanitize leaked credentials in test/orderBookingsPost.http
 2026-06-01 22:11:38 +02:00
Jeppe B 28bae85b2a Sanitize leaked credentials in order booking HTTP template 2026-06-01 22:11:23 +02:00
Jeppe B f2db92de09 Harden edge broker defaults and compose exposure 2026-06-01 22:10:14 +02:00
Jeppe B a41334f513 Merge pull request #185 from copenhagentruckwash/fix-mysql-debug-exposure-vulnerability 
Harden mysql-debug compose service configuration
 2026-06-01 22:09:46 +02:00
Jeppe B 175fb3a35f Harden mysql-debug compose service configuration 2026-06-01 22:09:35 +02:00
Jeppe B 21e9b2c80f Harden edge broker shared secret defaults 2026-06-01 22:08:20 +02:00
Jeppe B 286127c390 Merge pull request #182 from copenhagentruckwash/fix-edge-broker-default-shared-secret-issue 
Remove insecure default edge broker shared secret and stop exposing port 4300
 2026-06-01 22:07:10 +02:00
Jeppe B 6658af814b Remove committed env backup with secrets 2026-06-01 22:04:11 +02:00
Jeppe B 2abd6d04e9 Merge pull request #180 from copenhagentruckwash/fix-edge-broker-vulnerability-in-repository 
Harden edge broker compose defaults
 2026-06-01 22:02:41 +02:00
Jeppe B 61a09dce87 Remove insecure default edge broker secret fallback 2026-06-01 22:01:39 +02:00
Jeppe B a02ed69108 Merge pull request #181 from copenhagentruckwash/fix-remote-root-shell-execution-vulnerability 
Gate edge-agent shell actions behind local opt-in
 2026-06-01 22:01:01 +02:00
Jeppe B 9b69aadca4 Gate edge-agent shell actions behind local opt-in 2026-06-01 22:00:49 +02:00
Jeppe B 6204fb50f9 Harden edge broker compose defaults 2026-06-01 21:59:27 +02:00
Jeppe B 0a6a8aeab2 Merge pull request #179 from copenhagentruckwash/fix-vulnerability-in-ci-workflow 
Harden tests workflow: run PR jobs on GitHub-hosted runners
 2026-06-01 21:57:15 +02:00
Jeppe B d97cfda0ea Harden CI by avoiding self-hosted runners on PR workflow 2026-06-01 21:48:39 +02:00
Jeppe B aad5d77f41 Merge pull request #178 from copenhagentruckwash/propose-fix-for-exposure-of-sensitive-logs 
Remove committed Caddy access log containing leaked secrets
 2026-06-01 21:47:33 +02:00
Jeppe B 3b132cad95 Merge pull request #176 from copenhagentruckwash/fix-property-gate-command-authorization-bypass 
Restore explicit permissions for property gate commands to fix authorization bypass
 2026-06-01 21:03:30 +02:00
Jeppe B 688cb0a664 Merge pull request #173 from copenhagentruckwash/fix-cross-tenant-certificate-attachment-vulnerability 
Validate booking order context before certificates
 2026-06-01 21:00:33 +02:00
Jeppe B 6eb4171fea Merge pull request #172 from copenhagentruckwash/propose-fix-for-automation-permission-bug 
Prevent XL Vask list automation execution
 2026-06-01 21:00:21 +02:00
Jeppe B ddba27a1be Remove committed Caddy access log with leaked secrets 2026-06-01 20:59:59 +02:00
Jeppe B 18c6852865 Merge pull request #177 from copenhagentruckwash/fix-broker-secret-vulnerability-in-api 
Harden edge broker shared-secret handling
 2026-06-01 20:58:58 +02:00
Jeppe B 77403965f8 Harden edge broker shared-secret handling 2026-06-01 20:58:45 +02:00
Jeppe B 787db994dd Fix property gate command authorization bypass 2026-06-01 20:57:21 +02:00
Jeppe B f8f603a38e Merge pull request #175 from copenhagentruckwash/fix-vulnerability-in-studio-graph-edits 
Fix authorization boundary for studio graph lane operations
 2026-06-01 20:56:51 +02:00
Jeppe B 31a7224272 Fix studio graph lane operations permission checks 2026-06-01 20:56:38 +02:00
Jeppe B 492c81e27c Merge pull request #174 from copenhagentruckwash/fix-vulnerability-in-studio-action-conditions 
Fix fail-open condition gating in self-serve Studio action runner
 2026-06-01 20:56:21 +02:00
Jeppe B 45bfb1525a Fix studio action conditions to fail closed without results 2026-06-01 20:56:04 +02:00
Jeppe B 71ffa20811 Validate booking order context before certificates 2026-06-01 20:55:26 +02:00
Jeppe B a466c6291c Prevent XL Vask list automation execution 2026-06-01 20:54:44 +02:00
Jeppe B 9606d3b11d Merge pull request #171 from copenhagentruckwash/fix-sensitive-data-exposure-vulnerability 
Remove committed replication bootstrap snapshot with secrets
 2026-06-01 20:54:25 +02:00
Jeppe B 03b7fcd1b1 Remove committed replication bootstrap snapshot 2026-06-01 20:54:10 +02:00
Jeppe B 3d0f0f3391 Merge pull request #170 from copenhagentruckwash/fix-hard-coded-bearer-token-in-tests 
Remove committed bearer token from invoicing HTTP example
 2026-06-01 20:53:55 +02:00
Jeppe B e3257465a0 Remove hard-coded bearer token from invoicing HTTP example 2026-06-01 20:53:42 +02:00
Jeppe B 0c21f6e3a1 Merge pull request #169 from copenhagentruckwash/fix-gateway-auto-provision-deployment-vulnerability 
Pin gateway auto-provision deployments to source commit
 2026-06-01 20:53:22 +02:00
Jeppe B f1e5cacd0c Pin gateway auto-provision deployments to source commit 2026-06-01 20:53:10 +02:00
Jeppe B a8d5320ae5 Merge pull request #168 from copenhagentruckwash/fix-auto-promotion-vulnerability-in-release-gate 
Prevent auto-sync promotion when release gate `required_checks` is empty
 2026-06-01 20:52:52 +02:00
Jeppe B 95ac0d3a2c Block release gate auto-sync when required checks are empty 2026-06-01 20:52:39 +02:00
Jeppe B 1ed27dd467 Merge pull request #167 from copenhagentruckwash/fix-superuser-invite-resend-security-flaw 
Scope superuser subuser invite resends
 2026-06-01 20:52:23 +02:00
Jeppe B c4bb7bbb8b Scope superuser subuser invite resends 2026-06-01 20:52:08 +02:00
Jeppe B c09b7ebe76 Merge pull request #166 from copenhagentruckwash/fix-pathoutcomespayload-argument-type-error 
Accept null confirmation rows in pathOutcomesPayload
 2026-06-01 19:56:09 +02:00
Jeppe B 166ed6b92b Merge pull request #165 from copenhagentruckwash/fix-self-serve-invoice-assignment-issue 
Fix self-serve invoice customer attribution
 2026-06-01 19:54:28 +02:00
Jeppe B 8e528f3eae Fix null path confirmation rows 2026-06-01 19:53:40 +02:00
Jeppe B c8a5c3969d Fix self-serve invoice customer attribution 2026-06-01 19:48:10 +02:00
Jeppe B bb98df9e73 Merge pull request #164 from copenhagentruckwash/fix-truckwash-edge-gateway-stack.service-errors 
Fix edge gateway PHP Docker extension setup
 2026-06-01 19:30:15 +02:00
Jeppe B fe3719530a Fix edge gateway PHP image extensions 2026-06-01 19:19:01 +02:00
Jeppe B 603f497bef Merge pull request #163 from copenhagentruckwash/investigate-test-failure-issues 
ci: retry Release Manager gate on transient 504s
 2026-06-01 17:09:13 +02:00
Jeppe B ee16db8ecc ci: retry release manager gate on transient failures 2026-06-01 16:56:34 +02:00
Jeppe B c5c33d3cf7 Merge pull request #162 from copenhagentruckwash/fix-missing-happy-path-coverage-marker 
Restore selected orders API coverage
 2026-06-01 16:41:45 +02:00
Jeppe B da05c5adb7 Restore selected orders API coverage 2026-06-01 16:31:06 +02:00
Jeppe B 09fa186028 Merge pull request #161 from copenhagentruckwash/codex/master-tests-pass-api-20260528 
[codex] Fix backend master test gates
 2026-05-29 16:32:31 +02:00
Jeppe B 50b596af39 Merge pull request #157 from copenhagentruckwash/fix-issues-and-verify-with-tests 
Fix test gateway Windows config paths
 2026-05-28 19:39:51 +02:00
Jeppe B af06c4d81e Merge pull request #160 from copenhagentruckwash/copilot/fix-qodana-workflow-failure 
Fix Qodana failure on self-hosted runner by trusting workspace as Git safe.directory
 2026-05-28 19:39:25 +02:00
Jeppe B 41ed692299 Merge pull request #159 from copenhagentruckwash/fix-subuser-token-permission-bypass 
Restrict replication endpoints to classic users
 2026-05-28 19:37:54 +02:00
Jeppe B aceaa6b957 Fix Qodana workflow and Windows-style test gateway paths 
Update the Qodana workflow to use an available action version and avoid cloud-token failures when the secret is absent. Keep the test gateway path resolver using Windows path semantics for Windows-style inputs.
 2026-05-28 19:33:02 +02:00
Jeppe B 3fb1eb9644 Restrict replication endpoints to classic users 2026-05-28 19:25:59 +02:00
Jeppe B 76dfcd70d1 Merge pull request #158 from copenhagentruckwash/fix-authorization-bypass-in-self-serve-lanes 
Harden self-serve lane mutation authorization
 2026-05-28 19:25:01 +02:00
Jeppe B b13abe0d30 Harden self-serve lane mutation authorization 2026-05-28 19:23:31 +02:00
Jeppe B 270e5b970f Support Windows-style test gateway paths 
Resolve test gateway paths with the Windows path implementation when inputs use Windows-style syntax. This preserves the existing runnable script test suite without adding Windows-only tests.
 2026-05-28 19:16:52 +02:00
Jeppe B 5dac3211ff Fix test gateway Windows config paths 
### Motivation
- Tests that resolve the test gateway config directory were failing on Windows-style paths because the code always used the POSIX `path` module, producing mismatched separators.
- Preserve Windows path semantics when `rootDir` or an explicit config path uses Windows syntax while leaving POSIX behavior unchanged.

### Description
- Add `usesWindowsPathSyntax` and `pathForInputs` helpers to detect Windows-style paths and select `path.win32` when needed.
- Use the selected `pathModule` in `resolveConfigDirectory` to call `resolve`/`join` so Windows roots or explicit Windows dirs keep correct separators.
- Change is confined to `scripts/test-gateway.mjs` and does not alter other runtime behavior.

### Testing
- Ran `node --test scripts/*.test.mjs` which initially showed one failing path test and after the fix completed with all tests passing (`14` passed, `0` failed).
- Ran `npm test` in `services/edge-agent` and `services/edge-broker`, both suites passed (`18` and `23` tests respectively).
- Ran `node scripts/sync-ai-workflow.mjs --check` and `git diff --check` which both succeeded.
 2026-05-28 19:11:58 +02:00
Jeppe B 4d91fc8ead Fix test gateway Windows config paths 2026-05-28 19:00:31 +02:00
Jeppe B 893ed1bda5 Fix PHP CI legacy and edge gateway tests 
- Match self-serve legacy test double invoice signature.
- Wait for the edge gateway integration database before bootstrapping schema.
 2026-05-28 18:03:30 +02:00
Jeppe B 20eb92891a Avoid empty self-serve invoice orders 
Only create the invoice order context when elapsed minute billing has a positive quantity. This preserves automatic-mode included-minute reduction without leaving an empty order id on the lane.

Tests:
- bash scripts/php-ci-test.sh unit
 2026-05-28 17:21:36 +02:00
Jeppe B 2b905df478 Fix Caddy compose mounts for self-hosted Docker runtime 2026-04-24 00:19:13 +02:00
Jeppe B d9ed1ff9de Harden self-hosted CI workflow reliability 2026-04-24 00:10:10 +02:00
Jeppe B 1c647bb78b Avoid Traefik port collisions in edge gateway CI 2026-04-23 23:52:01 +02:00
Jeppe B 39d4ba0284 Run unit CI inside php1 container on self-hosted runner 2026-04-23 23:40:12 +02:00
Jeppe B 8a5e6bc302 Prepare Qodana temp directories on self-hosted runner 2026-04-23 23:35:13 +02:00
Jeppe B e7220f4f29 Run Qodana workflow on self-hosted runner 2026-04-23 23:16:45 +02:00
Jeppe B 54bada14f5 Fix edge agent shell polling and heartbeat metadata 2026-04-23 23:13:44 +02:00
Jeppe B 6925b47a5b Merge pull request #153 from copenhagentruckwash/backend-coolify-runner 
Backend coolify runner
 2026-04-21 22:19:21 +02:00
Jeppe B 218cf10ee3 Merge pull request #152 from copenhagentruckwash/edge-and-workers 
Add robust edge agent and gateway update handling mechanisms
 2026-04-15 13:44:12 +02:00
Jeppe B 9002b3a113 Merge pull request #139 from copenhagentruckwash/document-canonical-relationship-model-for-entities 
Clarify canonical self-serve relationships and condition/question naming intent
 2026-03-12 08:49:50 +01:00
Jeppe B fd389cf1a4 Merge pull request #141 from copenhagentruckwash/add-weatherapi-module-implementation-6ti277 
Add WeatherAPI module with routes, config and OpenAPI definitions
 2026-03-12 08:49:33 +01:00
Jeppe B 87c442040f Merge branch 'master' into add-weatherapi-module-implementation-6ti277 2026-03-12 08:49:24 +01:00
Jeppe B 7835f068b6 Merge pull request #140 from copenhagentruckwash/add-weatherapi-module-implementation 
Add WeatherAPI module, config and department weather timeline endpoints
 2026-03-11 14:52:16 +01:00
Jeppe B 3607aef2ca Align WeatherAPI OpenAPI schemas with actual response envelopes 2026-03-11 14:37:37 +01:00
Jeppe B 527e6a9ec4 Document WeatherAPI and department weather endpoints in OpenAPI 2026-03-11 13:56:29 +01:00
Jeppe B 3ec338457e Clarify self-serve entity relationships and naming intent 2026-03-11 13:54:11 +01:00
Jeppe B dd4c9da86c Merge pull request #137 
Add Bird voice webhook handler for automated gate opening and tighten test call number handling
 2026-03-09 09:47:01 +01:00
Jeppe B cc4e59a3e5 Fix inbound caller detection for Bird voice webhooks 2026-03-04 11:35:49 +01:00
Jeppe B 37f0f280d8 Adjust Bird inbound department prompt to press-digit menu 2026-03-04 11:17:57 +01:00
Jeppe B 218344650c Merge pull request #135 
Implement department gates and relays objects, CRUD routes and OpenAPI docs
 2026-03-03 12:06:13 +01:00
Jeppe B acc913c9b5 Implement department gates and relays objects and routes 2026-03-03 12:01:02 +01:00
Jeppe B 6853cdc9ce Merge pull request #131 from copenhagentruckwash/codex/find-and-fix-important-bug 
Fix selfserve lane bootstrap failures from eager logging dependencies
 2026-02-27 02:04:23 +01:00
Jeppe B 0bb032bd0f Fix selfserve lane logging bootstrap dependency handling 2026-02-27 02:02:30 +01:00
Jeppe B 48b625a8a0 Add Qodana code quality workflow 2026-02-24 10:24:21 +01:00
Jeppe B 82e41f45a9 Merge pull request #127 from copenhagentruckwash/scalability-enhancement 
scalability-enhancement
 2026-02-16 13:26:55 +01:00
Jeppe B d39bf2dbd6 Merge pull request #94 from copenhagentruckwash/copilot/add-openapi-documentation 
Add OpenAPI 3.0.3 specification for all API routes and schemas
 2026-01-05 13:16:38 +01:00
Jeppe B 62fbbdf38e Merge pull request #92 from copenhagentruckwash/updater-v1 
updater-v1
 2026-01-05 09:22:40 +01:00
Jeppe B a6d17b8828 Merge pull request #74 from copenhagentruckwash/xl-vask-module 
Xl vask module
 2025-07-14 14:26:53 +02:00
Jepp9350 ffd0606ece Enhance xlvask_tasks: introduce date range options and additional debug outputs for runSyncUsage. Add new parsers xlvask_parser_ingen_b_rster_foran_no_brush_wash_front and xlvask_parser_ht_dysebom and integrate into xlvask_helpers. Improve rate limiting and reduce FastCGI timeout in nginx configuration. Adjust execution time and memory limits in cli.php. 2025-07-14 09:22:32 +02:00
Jepp9350 edcb6e5926 Adjust cron job intervals: increase execution intervals for SyncUserEconomicCustomerDiscounts, SyncEconomicInvoiceStatus, and SyncXLVaskModuleCron to reduce frequency. 2025-07-11 08:37:34 +02:00
Jepp9350 0f8ec71ffe Enhance orders_o: add wash ID, timestamp creation, and detailed debug logging for mismatched totals. Add new parsers (xlvask_parser_ikke_b_rster_mellom_bil_og_trailer, xlvask_parser_s_be_dysebom_tak) and integrate into xlvask_helpers. Set memory limit in moduleXLVaskRoute. 2025-07-06 19:31:07 +02:00
Jepp9350 7a8edd0f28 Enhance orders_o and InvoicingPeriodRoute: expand duplicate detection logic by including additional registration fields, refine duplicate filtering criteria, and update transaction handling flag for possible duplicates. Add new xlvask_parser_ikke_ht_dysebom_mellom_bil_trailer parser and integrate it into xlvask_helpers. 2025-07-06 13:38:34 +02:00
Jepp9350 112f28228d Enhance vehiclesRoute: strip whitespace from vehicle registration numbers before setting values. 2025-07-03 12:23:02 +02:00